Resource-based constrained delegation fails across forests (was 'Invalid checksum' when requesting a ticket for a service in a trusted forest)

Open
#276 7 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
28/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
csharp
Domain
authentication, security

Research direction

Start with the C# reproduction using RequestServiceTicket and GetServiceTicket, then compare the good and bad network traces linked in the issue. Trace where the referral ticket is decrypted and the checksum exception occurs. Done means a ticket for the trusted-forest resource can be requested and the referral ticket followed without an Invalid checksum error.

Written by the indexing model from the issue text.

Description

enhancement

Describe the bug
When requesting a ticket for a service in another forest, decrypting the referral ticket results in this exception:

System.AggregateException
  HResult=0x80131500
  Message=One or more errors occurred.
  Source=mscorlib
  StackTrace:
   at System.Threading.Tasks.Task`1.GetResultCore(Boolean waitCompletionNotification)
   at System.Threading.Tasks.Task`1.get_Result()
   at KerbTest.Program.Main(String[] args) in C:\Users\Install.forest2\Desktop\KerbTest\KerbTest\Program.cs:line 14

  This exception was originally thrown at this call stack:
    [External Code]
    KerbTest.Program.MainAsync(string[]) in Program.cs

Inner Exception 1:
SecurityException: Invalid checksum

To Reproduce

//constrained delegation within the same forest works
var rst = new RequestServiceTicket();
rst.ServicePrincipalName = "MSSQLSvc/F2SQL1.forest2.net";
rst.S4uTicket = tgsUserForKerbTestService.Ticket;
var tgsServiceForF2SQL1 = await clientService.GetServiceTicket(rst);

//requesting a ticket for a resoruce in a trusted forest does not work (resource-based delegation)
rst = new RequestServiceTicket();
rst.ServicePrincipalName = "MSSQLSvc/F1SQL1.forest1.net";
rst.S4uTicket = tgsUserForKerbTestService.Ticket;
var tgsServiceForF1SQL1 = await clientService.GetServiceTicket(rst);

I have uploaded the full test project to https://github.com/raandree/KerbTest.

Expected behavior
Being able to request a ticket for a resource in another forest and follow the referral ticket.

Screenshots
I added two network traces, good and bad, to https://github.com/raandree/KerbTest.

Additional context
If you want to relay this in a ready-build lab, you may want to use the lab scripts provided in https://github.com/raandree/KerbTest. The require AutomatedLab.

Dominant language
C#
Stars
567
Forks
109
No merged PRs in 30d

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from dotnet/Kerberos.NET

All issues in dotnet/Kerberos.NET

Similar issues

More C# issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.